A binary file vulnerability analysis method based on multi-modal features

Abstract

The present application relates to the field of security, artificial intelligence technology, and in particular to a binary file vulnerability analysis method based on multi-modal features, a binary file sample set is constructed, vulnerability-related functions and their context functions of the binary file are extracted, static feature vectors and dynamic feature vectors are respectively generated for the vulnerability-related functions and their context functions, the static feature vectors and the dynamic feature vectors are fused to generate multi-modal feature vectors, the multi-modal feature vectors of the vulnerability-related functions and their context functions are fused to generate binary sample multi-modal feature vectors, which are used as inputs for training a deep learning model, the inputs are preprocessed, further feature learning and mapping are performed through multiple fully connected layers, and the softmax activation function is used in the output layer for classification, thereby improving the coverage and precision of binary vulnerability detection.

Description

Technical Field

[0001] The present invention relates to the fields of security and artificial intelligence technology, and in particular to a binary file vulnerability analysis method based on multimodal features. Background Art

[0002] Binary vulnerability detection is a technology that performs security analysis on programs without source code. It aims to discover flaws or vulnerabilities in binary programs that could potentially lead to security risks, such as buffer overflows, format string vulnerabilities, and null pointer dereferences. Many software releases are only available as binary files. Binary vulnerability detection can identify potential security risks, providing a crucial basis for vulnerability remediation, software hardening, and risk assessment. It is particularly important for protecting the security of these closed-source applications. Binary vulnerability detection technology is widely used in security audits of operating systems, embedded devices, IoT devices, and other fields, and is crucial for improving overall software security.

[0003] Most existing binary file vulnerability detection methods use rule matching, that is, collecting features related to vulnerability behavior patterns in advance, establishing a vulnerability rule library, extracting the behavioral pattern features of the binary file to be detected during detection, and detecting the vulnerability of the binary file by matching it with the rules in the vulnerability rule library.

[0004] Existing technologies, such as the invention patent with application number CN202211634641.3, disclose a binary file vulnerability detection method based on rule matching. According to the CPU architecture of the binary file, the corresponding target coding engine is used to disassemble the binary file to be detected to obtain assembly instructions. Then, the pre-defined target functions are located according to the assembly instructions. These target functions are selected based on pre-defined strategies and are node functions that the control flow of the program containing the vulnerability will pass through. Finally, starting from the target function, based on static features such as the program control flow, the vulnerability detection is performed on the binary file to be detected by comparing it with pre-defined behavioral pattern rules.

[0005] Some binary file vulnerability detection methods apply machine learning technology. These methods learn the static features of vulnerable binary files, build machine learning models, and use the models to detect binary file vulnerabilities.

[0006] The invention patent application number CN202210578652.8 discloses a cross-language binary vulnerability analysis method for unknown executable programs. The method first disassembles the binary file to obtain assembly code, then extracts language-related features from the assembly code. Machine learning techniques are used to train a programming language recognition model. Simultaneously, unsafe function features are extracted from the assembly code, and machine learning techniques are used to train vulnerability detection models for each programming language. During vulnerability detection, the method extracts programming language features and unsafe function features from the binary file to be detected, uses the programming language recognition model to identify the programming language of the binary file, and then uses the vulnerability detection model for the corresponding programming language to perform binary file vulnerability detection.

[0007] Traditional rule-matching-based binary vulnerability detection methods often fail to cover all vulnerability scenarios. Vulnerability rules are primarily based on manual experience, making it difficult to account for all vulnerability scenarios. Furthermore, it is impossible to extract rules for unknown vulnerabilities that have never occurred. Furthermore, rules cannot describe overly complex logic and cannot cover vulnerabilities in complex programs or scenarios. Because rules are relatively independent, detection requires matching each rule individually, resulting in low detection efficiency. This efficiency issue is particularly prominent when performing binary vulnerability detection on large-scale programs.

[0008] Machine learning-based binary vulnerability detection methods can address these issues. However, most existing machine learning-based methods rely solely on static features for model training, failing to consider the dynamic behavior that may occur during program execution. In some cases, vulnerabilities can only be triggered under specific operating conditions, so relying solely on static features can easily miss these vulnerabilities, resulting in limited detection accuracy. Summary of the Invention

[0009] In order to solve the above technical problems, the present invention provides a binary file vulnerability analysis method based on multimodal features, which improves the existing technology, overcomes the problems of insufficient rule coverage and detection efficiency in traditional rule-based matching methods, and the problem of detection accuracy caused by the use of a single feature in existing deep learning-based methods, thereby improving the coverage and accuracy of binary vulnerability detection.

[0010] To achieve the above objectives, the present invention adopts a technical solution: providing a binary file vulnerability analysis method based on multimodal features, comprising the following steps:

[0011] S1 builds a binary file sample set;

[0012] S1.1 Automatically obtain open source vulnerability information from public vulnerability data sources, including vulnerability types and vulnerability repair information, and extract the names and versions of binary software packages containing vulnerabilities from the open source vulnerability information;

[0013] S1.2 Download the binary package of the open source software from a public software download source based on the binary package name and version described in S1.1, and extract the binary file therefrom;

[0014] S1.3 Based on the vulnerability remediation information described in S1.1, determine the vulnerability-related functions and locate the binary files where the vulnerability-related functions are located. The binary file sample set only retains the binary files containing the vulnerability-related functions.

[0015] S2 extracts the multimodal feature vector of the binary file sample;

[0016] S2.1 converts the binary file into an intermediate language representation, generates an abstract syntax tree (AST), a control flow graph (CFG), and a data dependency graph (PDG) based on the intermediate language representation, obtains all functions that have call dependencies or data dependencies on the vulnerability-related function based on the control flow graph (CFG) and the data dependency graph (PDG), and forms a set of these functions into its context function;

[0017] S2.2 generates static feature vectors and dynamic feature vectors of vulnerability-related functions and their context functions respectively;

[0018] S2.3 uses a feature fusion method to fuse the static feature vector and dynamic feature vector generated by S2.2 into a multimodal feature vector, and fuses the multimodal feature vectors of the vulnerability-related function and its context function to generate a binary sample multimodal feature vector;

[0019] S3 trains deep learning models;

[0020] For each binary file sample, we first identify all vulnerability-related functions and their context functions, determine whether each binary file contains a vulnerability, and the vulnerability type, and optimize model parameters. The binary sample's multimodal feature vector is used as input for the model, which is preprocessed and further features are learned and mapped through multiple fully connected layers. The output layer uses a softmax activation function for classification.

[0021] S4 uses the trained deep learning model to detect binary file vulnerabilities.

[0022] Preferably, the binary package described in S1.2 includes a binary package of a version of the open source software with vulnerabilities and a binary package of a version without vulnerabilities, and a binary package contains one or more binary files.

[0023] Preferably, the static feature vector and dynamic feature vector generation process in S2.2 is as follows:

[0024] Static feature vectors: The three feature vectors of the abstract syntax tree AST, control flow graph CFG, and data dependency graph PDG generated by S2.1 are extracted as static feature vectors through the graph neural network GNN;

[0025] Dynamic feature vector: For the binary files corresponding to vulnerability-related functions and their context functions, symbolic execution technology is used to obtain their execution paths, extract the register operation sequence, memory access sequence, and system function call sequence during the execution process, and convert them into register operation feature vectors, memory access feature vectors, and system function call feature vectors respectively. These three feature vectors are used as dynamic feature vectors.

[0026] Preferably, the feature fusion method described in S2.3 includes:

[0027] Splicing and fusion: Let Fstatic be the static feature vector with dimension (d1), Fdynamic be the dynamic feature vector with dimension (d2), and the dimension of the spliced ​​multimodal feature vector Fmulti is (d1+d2), that is:

[0028] F multi =[F static , F dynamic ];

[0029] Weighted fusion: Assume that the static feature vector Fstatic and the dynamic feature vector Fdynamic are assigned weights α and (1-α) respectively, where α is a hyperparameter, and the feature vectors are merged by weighted averaging:

[0030] F multi =α·F static +(1-α)·F dynamic .

[0031] Preferably, the pretreatment process in S3 is as follows:

[0032] First, perform a convolution operation on the multimodal feature vector of the binary sample to extract the local feature vector:

[0033] F conv =σ(W*F multi +b),

[0034] Where W is the convolution kernel, * represents the convolution operation, b is the bias term, and σ is the activation function;

[0035] Perform pooling on the extracted local feature vector to reduce the dimension and retain key information:

[0036] F pool =maxpool(F conv ),

[0037] Among them, maxpool is a pooling operation.

[0038] Preferably, the calculation formula of the fully connected layer in S3 is:

[0039] F fc =W fc ·F pool +b fc ,

[0040] Where Wfc is the weight matrix of the fully connected layer, and bfc is the bias term;

[0041] The output layer converts the model output into a probability distribution to predict whether the binary file has a vulnerability and the vulnerability type:

[0042]

[0043] Where P(y=l|F multi ) represents the probability that a binary file contains vulnerability type l given the multimodal feature vector Fmulti.

[0044] Preferably, the S3 training process is optimized using a cross entropy loss function, where the loss function L is:

[0045]

[0046] Among them, y true is the true label of the binary file sample.

[0047] The above technical solution has the following advantages or beneficial effects:

[0048] The coverage of binary vulnerability detection is improved by extracting binary file features, using deep learning technology to train a binary vulnerability detection model, and using the model to identify complex feature patterns, thus overcoming the problem of insufficient rule coverage of traditional rule-based detection methods.

[0049] The accuracy of binary vulnerability detection is improved. This patent uses multimodal feature vectors of binary files, including static feature vectors and dynamic feature vectors, to build a model, capturing binary file feature patterns from different dimensions, so that the model can understand feature data more comprehensively and have stronger generalization capabilities. Compared with existing methods, the accuracy of binary vulnerability detection is improved.

[0050] The above summary is for illustrative purposes only and is not intended to be limiting in any way. In addition to the illustrative aspects, embodiments and features described above, further aspects, embodiments and features of the present invention will be readily apparent by reference to the accompanying drawings and the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In the accompanying drawings, unless otherwise specified, the same reference numerals throughout the multiple drawings represent the same or similar components or elements. These drawings are not necessarily drawn to scale. It should be understood that these drawings only depict some embodiments disclosed herein and should not be construed as limiting the scope of the invention.

[0052] Figure 1 A flowchart of a binary file vulnerability analysis method based on multimodal features provided by the present invention; DETAILED DESCRIPTION

[0053] Hereinafter, only certain exemplary embodiments are briefly described. As will be appreciated by those skilled in the art, the described embodiments may be modified in various ways without departing from the spirit or scope of the present invention. Therefore, the drawings and description are to be considered as illustrative in nature and not restrictive.

[0054] The present invention provides a binary file vulnerability analysis method based on multimodal features, the process is as follows Figure 1 As shown, the following steps are included:

[0055] S1 builds a binary file sample set;

[0056] S1.1 Automatically obtain open source vulnerability information from public vulnerability data sources, including vulnerability type and vulnerability repair information (such as commits and vulnerability reports for fixing vulnerabilities), and extract the name and version of the binary package containing the vulnerability from the open source vulnerability information;

[0057] The public vulnerability data sources include: NVD (U.S. National Vulnerability Database), CNVD (National Information Security Vulnerability Sharing Platform), and CNNVD (China National Information Security Vulnerability Database).

[0058] S1.2 Download the binary packages of the open source software from public software download sources (such as https: / / pkgs.org / and https: / / rpmfind.net / ) based on the binary software package names and versions described in S1.1, including binary packages of vulnerable and non-vulnerable versions of the open source software, and extract binary files from them. A binary package contains one or more binary files.

[0059] S1.3 Based on the vulnerability repair information described in S1.1, determine the vulnerability-related functions and use professional analysis tools (IDAPro or Ghidra) to locate the binary files where the vulnerability-related functions are located. The binary file sample set only retains the binary files that contain vulnerability-related functions, including the binary files in the vulnerable version of the software and the binary files in the non-vulnerable version.

[0060] The process of determining vulnerability-related functions is as follows: When the vulnerability repair information includes a vulnerability report, the description in the vulnerability report is analyzed to identify the vulnerability-related functions or code paths. The vulnerability report usually provides detailed vulnerability information, including the affected functions and code locations. If it does not include a vulnerability report, static analysis tools (including: Coverity, SonarQube, Clang Static Analyzer) are used to analyze the commit that fixes the vulnerability, and the vulnerability-related functions are confirmed based on the modified content.

[0061] S2 extracts the multimodal feature vector of the binary file sample;

[0062] S2.1 converts the binary file into an intermediate language representation between source code and assembly language, for example, using a conversion tool to convert the binary into LLVM's intermediate language IR. LLVM's intermediate language IR is an intermediate language representation of the code between source code and assembly language. This representation preserves information about the program structure and is independent of the CPU architecture, facilitating subsequent analysis.

[0063] Generate an Abstract Syntax Tree (AST), Control Flow Graph (CFG), and Program Dependency Graph (PDG) based on the intermediate language representation. For example, using the Joern code analysis tool, the intermediate language representation is converted into a Code Property Graph (CPG), and the AST, CFG, and PDG are generated based on the CPG. The CPG is a graph generated by superimposing the AST, CFG, and PDG. Compared to a traditional single AST or CFG, the CPG can carry more code information and make subsequent analysis programs more versatile.

[0064] According to the control flow graph CFG and data dependency graph PDG, all functions that have call dependencies or data dependencies on the vulnerability-related functions are obtained, and the set of these functions is their context function.

[0065] S2.2 generates static feature vectors and dynamic feature vectors of vulnerability-related functions and their context functions respectively;

[0066] The static feature vector and dynamic feature vector generation process are as follows:

[0067] Static feature vectors: The three feature vectors of the abstract syntax tree AST, control flow graph CFG, and data dependency graph PDG generated by S2.1 are extracted through the graph neural network GNN as static feature vectors;

[0068] In this process, graph2vec (graph2vec: Learning Distributed Representations of Graphs) is used to convert graphs into vectors.

[0069] Graph2vec is a deep learning method for converting graph data into fixed-dimensional vector representations. Its primary goal is to map structured graphs into a low-dimensional embedding space, where each graph can be represented as a fixed-length vector containing information about both nodes and the edges between them. These vectors can then be directly used in downstream tasks such as classification, clustering, regression, and other machine learning tasks.

[0070] The main idea of ​​graph2vec is to regard the graph as a document, the subgraph of each node (that is, the subgraph around the node) as a word in the document, and the subgraph of the surrounding nodes of a node as the context of the current node subgraph (that is, the sentence in the document). Then, the neural network is trained using the same method as document embedding (that is, converting documents containing words into vectors), optimizing the vector representation of the subgraph and the entire graph, maximizing the probability of the subgraph appearing in the entire graph, and finally obtaining the vector representation of the entire graph.

[0071]

[0072] Among them, d i represents a graph in the training sample, w j Representation Figure d i The subgraph of a node in , Pr(w j |d i ) represents the probability of a subgraph appearing in a graph. The training goal of graph2vec is to train the vectors of graphs and subgraphs so that the sum of the probabilities of all subgraphs appearing in the graph in the context sampled from the graph (i.e., a set of adjacent subgraphs) is maximized. i Indicates the length of the context. j |d i ) is calculated as:

[0073]

[0074] in, and Figure d i and subgraph w j The vector representation of , υ is the set of all subgraphs that appear in the training sample, w is the subgraph in the set, Let w be a vector representation. The specific calculation is performed using negative sampling.

[0075] When applying graph2vec, each node and edge of the graph is first represented as data. Each node of the AST represents a program element (such as a statement, expression, etc.), and each edge represents a parent-child relationship or a structured connection between nodes; each node of the CFG represents a basic block (for example, if it is a conditional judgment, there can be different jumps), and each edge represents the control flow relationship between basic blocks; each node of the PDG represents a data operation, and each edge represents the data dependency. Then, different unique functions are defined for the AST, CFG, and PDG, so that different subgraphs in the three graphs have different unique representations. Finally, the graph2vec deep learning model is trained separately to obtain the feature vectors of the abstract syntax tree (AST), control flow graph (CFG), and data dependency graph (PDG).

[0076] Dynamic feature vector: For the binary files corresponding to vulnerability-related functions and their context functions, symbolic execution technology is used to obtain their execution paths, extract the register operation sequence, memory access sequence, and system function call sequence during the execution process, and convert them into register operation feature vectors, memory access feature vectors, and system function call feature vectors respectively. These three feature vectors are used as dynamic feature vectors.

[0077] The concepts of symbolic execution technology are as follows:

[0078] Symbolic execution is a program analysis technique that simulates the program's execution path and explores all possible paths by treating the program's inputs as symbolic values ​​(rather than specific numerical values). The angr symbolic execution framework can be used to perform symbolic execution on binary files and obtain the program's execution path. Furthermore, by monitoring register operations during execution, the register operation sequence can be obtained; by monitoring memory read and write operations during execution, the memory access sequence can be obtained; and by monitoring the content of executed instructions, the system call sequence can be obtained.

[0079] The steps to extract an example of the above sequence using the angr symbolic execution tool are as follows:

[0080] Step S01: Loading a binary file;

[0081] Step S02: Get the starting address of the program;

[0082] Step S03: Create a symbolic execution path explorer;

[0083] Step S04: perform symbolic execution to explore paths;

[0084] Step S05: monitor the executed instructions and extract the above sequence;

[0085] After obtaining register operation, memory access, and system call sequences, these sequences are converted into feature vectors. For sequence data, a common vectorization method is Seq2Vec. Seq2Vec is a tool that converts sequences (in this patent, register operation sequences, memory access sequences, and system call sequences) into vectors. It can map the elements in each sequence (such as instructions, register values, etc.) into a high-dimensional space and ultimately output a vector.

[0086] Through symbolic execution and sequence embedding technology, the register operation sequence, memory access sequence, and system function call sequence are converted into a fixed-length vector respectively, preparing for subsequent analysis and model training.

[0087] S2.3 uses a feature fusion method to fuse the static feature vector and dynamic feature vector generated by S2.2 into a multimodal feature vector, and fuses the multimodal features of the vulnerability-related function and its context function to generate a binary sample multimodal feature vector;

[0088] The feature fusion method includes:

[0089] Splicing and fusion: Splice different feature vectors together to form a longer feature vector. Let Fstatic be the static feature vector with dimension (d1), Fdynamic be the dynamic feature vector with dimension (d2), and the dimension of the spliced ​​multimodal feature vector Fmulti is (d1+d2), that is:

[0090] F multi =[F static , F dynamic ];;

[0091] For example, after feature extraction of a binary file, the following static feature vector and dynamic feature vector are obtained:

[0092] The dimension of the static feature vector Fstatic is 256 and is represented as a 256-dimensional vector.

[0093] The dimension of the dynamic feature vector Fdynamic is 256 and is represented as a 256-dimensional vector.

[0094] Select the splicing fusion method to obtain the multimodal feature vector F multi The dimension is (256+256=512).

[0095] Weighted fusion: Different weights are assigned according to the importance of features, and the static feature vector and dynamic feature vector are weighted and synthesized according to the weights. The static feature vector Fstatic and the dynamic feature vector Fdynamic are assigned weights α and (1-α) respectively, where α is a hyperparameter that controls the fusion ratio of the static feature vector and the dynamic feature vector. The two types of features are merged through weighted averaging:

[0096] F multi =α·F static +(1-α)·F dynamic .

[0097] S3 trains deep learning models;

[0098] A convolutional neural network (CNN) was chosen as the basis for the training model. CNNs are particularly well-suited for processing input data with spatial structure, and are particularly advantageous in extracting local features and patterns. Although CNNs are commonly used for image processing, they are particularly effective in capturing local relationships between different features when processing multimodal feature vectors. Given a binary sample input multimodal feature vector, the model extracts features through multiple convolutional and pooling layers, ultimately performing classification output through a fully connected layer.

[0099] When using CNN for binary file vulnerability detection, all vulnerability-related functions and their context functions are identified for each binary file sample, and whether each binary file contains a vulnerability and its vulnerability type (such as buffer overflow, SQL injection, etc.) are obtained to guide the optimization of model parameters.

[0100] The specific steps for training a deep learning model using multimodal feature vectors are as follows:

[0101] The multimodal feature vector of binary samples is used as the input of the model, which is preprocessed and further feature learning and mapping is performed through multiple fully connected layers. The output layer uses the softmax activation function for classification.

[0102] The pre-processing process is as follows:

[0103] First, perform a convolution operation on the multimodal feature vector of the binary sample to extract the local feature vector:

[0104] F conv =σ(W*F multi +b),

[0105] Where W is the convolution kernel, * represents the convolution operation, b is the bias term, and σ is the activation function;

[0106] Perform pooling on the extracted local feature vector to reduce the dimension and retain key information:

[0107] F pool =maxpool(F conv ),

[0108] Among them, maxpool is a pooling operation.

[0109] The calculation formula of the fully connected layer is:

[0110] F fc =W fc ·F pool +b fc ,

[0111] Where Wfc is the weight matrix of the fully connected layer, and bfc is the bias term;

[0112] The output layer converts the model output into a probability distribution to predict whether the binary file has a vulnerability and the vulnerability type:

[0113]

[0114] Where P(y=l|F multi ) represents the probability that a binary file contains vulnerability type l given the multimodal feature vector Fmulti.

[0115] The training process is optimized using the cross entropy loss function, and the loss function L is:

[0116]

[0117] Among them, y true is the true label of the binary file sample.

[0118] During the training process, the network parameters are continuously adjusted and the loss function is optimized until the model converges.

[0119] Vulnerability information from binary files (whether they contain a vulnerability, and if so, their vulnerability type) is used as feedback during model training to adjust model parameters until the model converges. Through repeated training and adjustment, the model gradually improves its vulnerability recognition capabilities and ultimately outputs accurate vulnerability prediction results.

[0120] The specific process of S4 using the trained deep learning model to detect binary file vulnerabilities is as follows:

[0121] S4.1 Input data preparation:

[0122] Binary file parsing: First, extract each function in the binary file and its context function. The context function includes the functions related to the call relationship (such as the directly called function and the called function).

[0123] Multimodal feature vector generation: For each extracted function and its context function, a multimodal feature vector is generated. Static feature vectors (including the abstract syntax tree (AST), control flow graph (CFG), and data dependency graph (PDG)) are obtained using graph2vec, while dynamic feature vectors (including register operations, memory accesses, and system call sequences) are generated through symbolic execution. These features are then fused to generate a multimodal feature vector Fmulti for each function and its context function.

[0124] S4.2 Multimodal feature vector fusion and input model:

[0125] For each function Ffunc and its context function Fcontext, their multimodal feature vectors are fused to form the final input feature vector Finput, which contains both the static feature vector and dynamic feature vector information of each function and its context function:

[0126] F input =[F func , F context ].

[0127] S4.3 Predicting binary file vulnerabilities:

[0128] After forward propagation of the deep learning model convolutional neural network CNN, the model outputs whether the function has a vulnerability and, if so, predicts the type of vulnerability.

[0129] Model output: The model ultimately outputs a vulnerability prediction, including whether the binary file has a vulnerability and, if so, the predicted vulnerability type (such as buffer overflow, SQL injection, etc.).

[0130] S4.4 Vulnerability report generation:

[0131] Based on the model output, a vulnerability report is generated for each binary file's function. The report includes the vulnerability status and vulnerability type of the function. If a vulnerability exists, the report can further provide possible vulnerability locations and remediation suggestions.

[0132] This method leverages a trained deep learning model to detect vulnerabilities in binary files. By extracting multimodal feature vectors from each function and its related functions and inputting them into the deep learning model, the model outputs the vulnerability status and vulnerability type for each function. This method efficiently detects and classifies vulnerabilities in binary files and provides strong support for security analysis.

[0133] The above technical solution has the following advantages or beneficial effects: the present invention improves the coverage of binary vulnerability detection by extracting binary file features, using deep learning technology to train a binary vulnerability detection model, and using the model to identify complex feature patterns, thereby overcoming the problem of insufficient rule coverage of traditional rule-based detection methods.

[0134] The accuracy of binary vulnerability detection is improved. This patent uses multimodal feature vectors of binary files, including static feature vectors and dynamic feature vectors, to build a model, capturing binary file feature patterns from different dimensions, so that the model can understand feature data more comprehensively and have stronger generalization capabilities. Compared with existing methods, the accuracy of binary vulnerability detection is improved.

[0135] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various modifications and substitutions within the technical scope disclosed in the present invention, and such modifications and substitutions are intended to be within the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be subject to the scope of protection of the claims.

Claims

1. A binary file vulnerability analysis method based on multimodal features, characterized in that: The steps include: S1 builds a binary file sample set; S1.1 Automatically obtain open source vulnerability information from public vulnerability data sources, including vulnerability types and vulnerability repair information, and extract the names and versions of binary software packages containing vulnerabilities from the open source vulnerability information; S1.2 Download the binary package of the open source software from a public software download source based on the binary package name and version described in S1.1, and extract the binary file therefrom; S1.3 Based on the vulnerability remediation information described in S1.1, determine the vulnerability-related functions and locate the binary files where the vulnerability-related functions are located. The binary file sample set only retains the binary files containing the vulnerability-related functions. S2 extracts the multimodal feature vector of the binary file sample; S2.1 converts the binary file into an intermediate language representation, generates an abstract syntax tree (AST), a control flow graph (CFG), and a data dependency graph (PDG) based on the intermediate language representation, obtains all functions that have call dependencies or data dependencies on the vulnerability-related function based on the control flow graph (CFG) and the data dependency graph (PDG), and forms a set of these functions into its context function; S2.2 generates static feature vectors and dynamic feature vectors of vulnerability-related functions and their context functions respectively; The static feature vector and dynamic feature vector generation process are as follows: Static feature vectors: The three feature vectors of the abstract syntax tree AST, control flow graph CFG, and data dependency graph PDG generated by S2.1 are extracted as static feature vectors through the graph neural network GNN; Dynamic feature vectors: Symbolic execution technology is used to obtain the execution path of the binary files corresponding to vulnerability-related functions and their context functions. The register operation sequence, memory access sequence, and system function call sequence during the execution process are extracted and converted into register operation feature vectors, memory access feature vectors, and system function call feature vectors, respectively. These three feature vectors are used as dynamic feature vectors. S2.3 uses a feature fusion method to fuse the static feature vector and dynamic feature vector generated by S2.2 into a multimodal feature vector, and fuses the multimodal feature vectors of the vulnerability-related function and its context function to generate a binary sample multimodal feature vector; S3 trains deep learning models; For each binary file sample, we first identify all vulnerability-related functions and their context functions, determine whether each binary file contains a vulnerability, and the vulnerability type. We then optimize model parameters and use the binary sample's multimodal feature vector as input for preprocessing. We then perform further feature learning and mapping through multiple fully connected layers, and use the softmax activation function for classification at the output layer. S4 uses the trained deep learning model to detect binary file vulnerabilities.

2. The binary file vulnerability analysis method based on multimodal features according to claim 1, characterized in that: The binary packages described in S1.2 include binary packages of versions of open source software with vulnerabilities and binary packages of versions without vulnerabilities. A binary package contains one or more binary files.

3. The binary file vulnerability analysis method based on multimodal features according to claim 1, characterized in that: The feature fusion method described in S2.3 includes: Splicing and fusion: Let Fstatic be the static feature vector with dimension (d1), Fdynamic be the dynamic feature vector with dimension (d2), and the dimension of the spliced ​​multimodal feature vector Fmulti is (d1+d2), that is: F multi =[F static ,F dynamic ]; Weighted fusion: Assume that the static feature vector Fstatic and the dynamic feature vector Fdynamic are assigned weights α and (1-α) respectively, where α is a hyperparameter, and the feature vectors are merged by weighted averaging: F multi =α·F static +(1-α)·F dynamic 。 4. The binary file vulnerability analysis method based on multimodal features according to claim 1, characterized in that: The preprocessing process described in S3 is as follows: First, perform a convolution operation on the multimodal feature vector of the binary sample to extract the local feature vector: F conv =σ(W*F multi +b), Where W is the convolution kernel, * represents the convolution operation, b is the bias term, and σ is the activation function; Perform pooling on the extracted local feature vector to reduce the dimension and retain key information: F pool =maxpool(F conv ), Among them, maxpool is a pooling operation.

5. The binary file vulnerability analysis method based on multimodal features according to claim 1, characterized in that: The calculation formula of the fully connected layer in S3 is: F fc =W fc ·F pool +b fc , Where Wfc is the weight matrix of the fully connected layer, and bfc is the bias term; The output layer converts the model output into a probability distribution to predict whether the binary file has a vulnerability and the vulnerability type: Where P(y=l|F multi ) represents the probability that a binary file contains vulnerability type l given the multimodal feature vector Fmulti.

6. The binary file vulnerability analysis method based on multimodal features according to claim 1, characterized in that: The S3 training process is optimized using the cross entropy loss function, and the loss function L is: Among them, y true is the true label of the binary file sample.

Images